A UI misrepresentation flaw exists in Google Chrome versions earlier than 156.0.8078.47, enabling a remote attacker to spoof browser UI elements via a crafted HTML page and exploit social engineering. The vulnerability is classified as Missing Authorization weakness (CWE‑451) and can mislead users into interacting with forged controls, potentially leading to credential leakage or other social engineering attacks.

All users running Google Chrome versions earlier than 156.0.8078.47 are affected. The flaw is present in the stable channel of Chrome, and the patch is released in update 156.0.8078.47.

The CVSS score of 8.8 places the flaw in the high severity range. The EPSS score of < 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, with an attacker delivering a crafted HTML page that a victim opens or visits. The risk is driven by the vulnerability’s ability to deceive users into interacting with forged UI elements, leading to potential credential leakage or other social engineering consequences.